The Incident Object Description Exchange Format Version 2

The specifics of the IODEF information model are discussed in this section. Each class and its relationships with the other classes is described. When necessary, clarifications are made about translating this information model to the schema in .

The IODEF-Document class is the top level class in the IODEF data model. All IODEF documents are an instance of this class.

--{1..*}--[ Incident ] | ENUM xml:lang |<>--{0..*}--[ AdditionalData ] | STRING format-id | | STRING private-enum-name | | STRING private-enum-id | +--------------------------+ ]]> The aggregate classes of the IODEF-Document class are: One or more. The information related to a single incident. See . Zero or more. EXTENSION. Mechanism by which to extend the data model. The attributes of the IODEF-Document class are: Required. STRING. The IODEF specification version number to which this IODEF document conforms. The value of this attribute MUST be "2.00". Optional. ENUM. A language identifier per Section 2.12 of whose values and form are described in . The interpretation of this code is described in . Optional. STRING. A free-form string to convey processing instructions to the recipient of the document. Its semantics must be negotiated out of band. Optional. STRING. A globally unique identifier for the CSIRT generating the document to deconflict private extensions used in the document. The fully qualified domain name (FQDN) associated with the CSIRT MUST be used as the identifier. See . Optional. STRING. An organizationally unique identifier for an extension used in the document. If this attribute is set, the private-enum-name MUST also be set. See .

The Incident class describes commonly exchanged information when reporting or sharing derived analysis from security incidents.

----------[ IncidentID ] | STRING ext-purpose |<>--{0..1}--[ AlternativeID ] | ENUM status |<>--{0..*}--[ RelatedActivity ] | STRING ext-status |<>--{0..1}--[ DetectTime ] | ENUM xml:lang |<>--{0..1}--[ StartTime ] | ENUM restriction |<>--{0..1}--[ EndTime ] | STRING ext-restriction |<>--{0..1}--{ RecoveryTime ] | ID observable-id |<>--{0..1}--[ ReportTime ] | |<>----------[ GenerationTime ] | |<>--{0..*}--[ Description ] | |<>--{0..*} [ Discovery ] | |<>--{0..*}--[ Assessment ] | |<>--{0..*}--[ Method ] | |<>--{1..*}--[ Contact ] | |<>--{0..*}--[ EventData ] | |<>--{0..1}--[ IndicatorData ] | |<>--{0..1}--[ History ] | |<>--{0..*}--[ AdditionalData ] +-------------------------+ ]]> The aggregate classes of the Incident class are: One. An incident tracking number assigned to this incident by the CSIRT that generated the IODEF document. See . Zero or one. The incident tracking numbers used by other CSIRTs to refer to the incident described in the document. See . Zero or more. Related activity and attribution of this activity. See . Zero or one. DATETIME. The time the incident was first detected. Zero or one. DATETIME. The time the incident started. Zero or one. DATETIME. The time the incident ended. Zero or one. DATETIME. The time the site recovered from the incident. Zero or one. DATETIME. The time the incident was reported. One. DATETIME. The time the content in this Incident class was generated. Zero or more. ML_STRING. A free-form text description of the incident. Zero or more. The means by which this incident was detected. See . Zero or more. A characterization of the impact of the incident. See . Zero or more. The techniques used by the threat actor in the incident. See . One or more. Contact information for the parties involved in the incident. See . Zero or more. Description of the events comprising the incident. See . Zero or one. Indicators from the analysis of an incident. See . Zero or one. A log of significant events or actions that occurred during the course of handling the incident. See . Zero or more. EXTENSION. Mechanism by which to extend the data model. The attributes of the Incident class are: Required. ENUM. The purpose attribute describes the rationale for documenting the information in this class. It is closely related to the Expectation class. These values are maintained in the "Incident-purpose" IANA registry per . This attribute is defined as an enumerated list: traceback. The incident was sent for trace-back purposes. mitigation. The incident was sent to request aid in mitigating the described activity. reporting. The incident was sent to comply with reporting requirements. watch. The incident was sent to convey indicators that should be monitored. other. The incident was sent for purposes specified in the Expectation class. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the purpose attribute. See . Optional. ENUM. The status attribute conveys the state in a workflow where the incident is currently found. These values are maintained in the "Incident-status" IANA registry per . This attribute is defined as an enumerated list: new. The incident is newly reported, and no action has been taken. in-progress. The incident is under investigation. forwarded. The incident has been forwarded to another party for handling. resolved. The investigation into the activity in this incident has concluded. future. The described activity has not yet been detected. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the status attribute. See . Optional. ENUM. A language identifier per Section 2.12 of whose values and form are described in . The interpretation of this code is described in . Optional. ENUM. See . The default value is "private". Optional. STRING. A means by which to extend the restriction attribute. See . Optional. ID. See .

There are a number of recurring attributes used in the information model. They are documented in this section.

The restriction attribute indicates the disclosure guidelines to which the sender expects the recipient to adhere for the information represented in this class and its children. This guideline provides no security since there are no technical means to ensure that the recipient of the document handles the information as the sender requested. The value of this attribute is logically inherited by the children of this class. That is to say, the disclosure rules applied to this class also apply to its children. It is possible to set a granular disclosure policy, since all of the high-level classes (i.e., children of the Incident class) have a restriction attribute. Therefore, a child can override the guidelines of a parent class, be it to restrict or relax the disclosure rules (e.g., a child has a weaker policy than an ancestor; or an ancestor has a weak policy, and the children selectively apply more rigid controls). The implicit value of the restriction attribute for a class that did not specify one can be found in the closest ancestor that did specify a value. This attribute is defined as an enumerated value with a default value of "private". Note that the default value of the restriction attribute is only defined in the context of the Incident class. In other classes where this attribute is used, no default is specified. These values are maintained in the "Restriction" IANA registry per . public. The information can be freely distributed without restriction. partner. The information may be shared within a closed community of peers, partners, or affected parties, but cannot be openly published. need-to-know. The information may be shared only within the organization with individuals that have a need to know. private. The information may not be shared. default. The information can be shared according to an information disclosure policy pre-arranged by the communicating parties. white. Same as 'public'. green. Same as 'partner'. amber. Same as 'need-to-know'. red. Same as 'private'. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See .

The observable-id attribute tags information in the document as an observable so that it can be referenced later in the description of an indicator. The value of this attribute is a unique identifier in the scope of the document. It is used by the ObservableReference class to enumerate observables when defining an indicator with the IndicatorData class.

The IncidentID class represents a tracking number that is unique in the context of the CSIRT. It serves as an identifier for an incident or a document identifier when sharing indicators. This identifier would serve as an index into a CSIRT's incident handling or knowledge management system. The combination of the name attribute and the string in the element content MUST be a globally unique identifier describing the activity. Documents generated by a given CSIRT MUST NOT reuse the same value unless they are referencing the same incident.

The content of the class is an incident identifier of type STRING. The attributes of the IncidentID class are: Required. STRING. An identifier describing the CSIRT that created the document. In order to have a globally unique CSIRT name, the fully qualified domain name associated with the CSIRT MUST be used. Optional. STRING. An identifier referencing a subset of the named incident. Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The AlternativeID class lists the tracking numbers used by CSIRTs, other than the one generating the document, to refer to the identical activity described in the IODEF document. A tracking number listed as an AlternativeID references the same incident detected by another CSIRT. The tracking numbers of the CSIRT that generated the IODEF document must never be considered an AlternativeID.

--{1..*}--[ IncidentID ] | STRING ext-restriction | +------------------------+ ]]> The aggregate class of the AlternativeID class is: One or more. The tracking number of another CSIRT. See . The attributes of the AlternativeID class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The RelatedActivity class relates the information described in the rest of the document to previously observed incidents or activity and allows attribution to a specific actor or campaign.

--{0..*}--[ IncidentID ] | STRING ext-restriction |<>--{0..*}--[ URL ] | |<>--{0..*}--[ ThreatActor ] | |<>--{0..*}--[ Campaign ] | |<>--{0..*}--[ IndicatorID ] | |<>--{0..1}--[ Confidence ] | |<>--{0..*}--[ Description ] | |<>--{0..*}--[ AdditionalData ] +------------------------+ ]]> The aggregate classes of the RelatedActivity class are: Zero or more. The tracking number of a related incident. See . Zero or more. URL. A URL to activity related to this incident. Zero or more. The threat actor to whom the incident activity is attributed. See . Zero or more. The campaign of a given threat actor to whom the described activity is attributed. See . Zero or more. A reference to a related indicator. See . Zero or one. An estimate of the confidence in attributing this RelatedActivity to the events described in the document. See . Zero or more. ML_STRING. A description of how these relationships were derived. Zero or more. EXTENSION. A mechanism by which to extend the data model. The RelatedActivity class MUST have at least one instance of any of the following child classes: IncidentID, URL, ThreatActor, Campaign, Description, or AdditionalData. The attributes of the RelatedActivity class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The ThreatActor class describes a threat actor.

--{0..*}--[ ThreatActorID ] | STRING ext-restriction |<>--{0..*}--[ URL ] | |<>--{0..*}--[ Description ] | |<>--{0..*}--[ AdditionalData ] +------------------------+ ]]> The aggregate classes of the ThreatActor class are: Zero or more. STRING. An identifier for the threat actor. Zero or more. URL. A URL to a reference describing the threat actor. Zero or more. ML_STRING. A description of the threat actor. Zero or more. EXTENSION. A mechanism by which to extend the data model. The ThreatActor class MUST have at least one instance of a child class. The attributes of the ThreatActor class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The Campaign class describes a campaign of attacks by a threat actor.

--{0..*}--[ CampaignID ] | STRING ext-restriction |<>--{0..*}--[ URL ] | |<>--{0..*}--[ Description ] | |<>--{0..*}--[ AdditionalData ] +------------------------+ ]]> The aggregate classes of the Campaign class are: Zero or more. STRING. An identifier for the campaign. Zero or more. URL. A URL to a reference describing the campaign. Zero or more. ML_STRING. A description of the campaign. Zero or more. EXTENSION. A mechanism by which to extend the data model. The Campaign class MUST have at least one instance of a child class. The attributes of the Campaign class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The Contact class describes contact information for organizations and personnel involved in the incident. This class allows for the naming of the involved party, specifying contact information for them, and identifying their role in the incident. People and organizations are treated interchangeably as contacts; one can be associated with the other using the recursive definition of the class (the Contact class is aggregated into the Contact class). The type attribute disambiguates the type of contact information being provided. The recursive definition of Contact provides a way to relate information without requiring the explicit use of identifiers or duplication of data. A complete point of contact is derived by a particular traversal from the root Contact class to the leaf Contact class. Each child Contact class logically inherits contact information from its ancestors.

--{0..*}--[ ContactName ] | STRING ext-role |<>--{0..*}--[ ContactTitle ] | ENUM type |<>--{0..*}--[ Description ] | STRING ext-type |<>--{0..*}--[ RegistryHandle ] | ENUM restriction |<>--{0..*}--[ PostalAddress ] | STRING ext-restriction |<>--{0..*}--[ Email ] | |<>--{0..*}--[ Telephone ] | |<>--{0..1}--[ Timezone ] | |<>--{0..*}--[ Contact ] | |<>--{0..*}--[ AdditionalData ] +------------------------+ ]]> The aggregate classes of the Contact class are: Zero or more. ML_STRING. The name of the contact. The contact may either be an organization or a person. The type attribute disambiguates the semantics. Zero or more. ML_STRING. The title for the individual named in the ContactName. Zero or more. ML_STRING. A free-form text description of the contact. Zero or more. A handle name into the registry of the contact. See . Zero or more. The postal address of the contact. See . Zero or more. The email address of the contact. See . Zero or more. The telephone number of the contact. See . Zero or one. TIMEZONE. The timezone in which the contact resides. Zero or more. A recursive definition of the Contact class. This definition can be used to group common data pertaining to multiple points of contact and is especially useful when listing multiple contacts at the same organization. Zero or more. EXTENSION. A mechanism by which to extend the data model. At least one of the aggregate classes MUST be present in an instance of the Contact class. The attributes of the Contact class are: Required. ENUM. Indicates the role the contact fulfills. These values are maintained in the "Contact-role" IANA registry per . creator. The entity that generates the document. reporter. The entity that reported the information. admin. An administrative contact or business owner for an asset or organization. tech. An entity responsible for the day-to-day management of technical issues for an asset or organization. provider. An external hosting provider for an asset. user. An end-user of an asset or part of an organization. billing. An entity responsible for billing issues for an asset or organization. legal. An entity responsible for legal issues related to an asset or organization. irt. An entity responsible for handling security issues for an asset or organization. abuse. An entity responsible for handling abuse originating from an asset or organization. cc. An entity that is to be kept informed about the events related to an asset or organization. cc-irt. A CSIRT or information-sharing organization coordinating activity related to an asset or organization. leo. A law enforcement organization supporting the investigation of activity affecting an asset or organization. vendor. The vendor that produces an asset. vendor-support. A vendor that provides services. victim. A victim in the incident. victim-notified. A victim in the incident who has been notified. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the role attribute. See . Required. ENUM. Indicates the type of contact being described. This attribute is defined as an enumerated list. These values are maintained in the "Contact-type" IANA registry per . person. The information for this contact references an individual. organization. The information for this contact references an organization. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the type attribute. See . Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The RegistryHandle class represents a handle into an Internet registry or community-specific database.

The content of the class is a handle into a registry of type STRING. The attributes of the RegistryHandle class are: Required. ENUM. The database to which the handle belongs. These values are maintained in the "RegistryHandle-registry" IANA registry per . The possible values are: internic. Internet Network Information Center apnic. Asia Pacific Network Information Center arin. American Registry for Internet Numbers lacnic. Latin American and Caribbean Internet Addresses Registry ripe. Reseaux IP Europeens afrinic. African Network Information Center local. A database local to the CSIRT ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the registry attribute. See .

The PostalAddress class specifies a postal address and associated annotation.

----------[ PAddress ] | STRING ext-type |<>--{0..*}--[ Description ] +--------------------+ ]]> The aggregate classes of the PostalAddress class are: One. POSTAL. A postal address. Zero or more. ML_STRING. A free-form text description of the address. The attributes of the PostalAddress class are: Optional. ENUM. Categorizes the type of address described in the PAddress class. These values are maintained in the "PostalAddress-type" IANA registry per . street. An address describing a physical location. mailing. An address to which correspondence should be sent. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the type attribute. See .

The Email class specifies an email address and associated annotation.

----------[ EmailTo ] | STRING ext-type |<>--{0..*}--[ Description ] +--------------------+ ]]> The aggregate classes of the Email class are: One. EMAIL. An email address. Zero or more. ML_STRING. A free-form text description of the email address. The attributes of the Email class are: Optional. ENUM. Categorizes the type of email address described in the EmailTo class. These values are maintained in the "Email-type" IANA registry per . direct. An email address of an individual. hotline. An email address regularly monitored for operational purposes. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the type attribute. See .

The Telephone class describes a telephone number and associated annotation.

----------[ TelephoneNumber ] | STRING ext-type |<>--{0..*}--[ Description ] +--------------------+ ]]> The aggregate classes of the Telephone class are: One. PHONE. A telephone number. Zero or more. ML_STRING. A free-form text description of the phone number. The attributes of the Telephone class are: Optional. ENUM. Categorizes the type of telephone number described in the TelephoneNumber class. These values are maintained in the "Telephone-type" IANA registry per . wired. A number of a wire-line (land-line) phone. mobile. A number of a mobile phone. fax. A number to a fax machine. hotline. A number to a regularly monitored operational hotline. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the type attribute. See .

The Discovery class describes how an incident was detected.

--{0..*}--[ Description ] | STRING ext-source |<>--{0..*}--[ Contact ] | ENUM restriction |<>--{0..*}--[ DetectionPattern ] | STRING ext-restriction | +------------------------+ ]]> The aggregate classes of the Discovery class are: Zero or more. ML_STRING. A free-form text description of how this incident was detected. Zero or more. Contact information for the party that discovered the incident. See . Zero or more. Describes an application-specific configuration that detected the incident. See . The attributes of the Discovery class are: Optional. ENUM. Categorizes the techniques used to discover the incident. These values are partially derived from Table 3-1 of . These values are maintained in the "Discovery-source" IANA registry per . nidps. Network Intrusion Detection or Prevention System. hips. Host-based Intrusion Prevention System. siem. Security Information and Event Management System. av. Antivirus or antispam software. third-party-monitoring. Contracted third-party monitoring service. incident. The activity was discovered while investigating an unrelated incident. os-log. Operating system logs. application-log. Application logs. device-log. Network device logs. network-flow. Network flow analysis. passive-dns. Passive DNS analysis. investigation. Manual investigation initiated based on notification of a new vulnerability or exploit. audit. Security audit. internal-notification. A party within the organization reported the activity. external-notification. A party outside of the organization reported the activity. leo. A law enforcement organization notified the victim organization. partner. A customer or business partner reported the activity to the victim organization. actor. The threat actor directly or indirectly reported this activity to the victim organization. unknown. Unknown detection approach. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the source attribute. See . Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The DetectionPattern class describes a configuration or signature that can be used by an Intrusion Detection System (IDS) / Intrusion Prevention System (IPS), SIEM, antivirus, endpoint protection, network analysis, malware analysis, or host forensics tool to identify a particular phenomenon. This class requires the identification of the target application and allows the configuration to be described in either free form or machine-readable form.

----------[ Application ] | STRING ext-restriction |<>--{0..*}--[ Description ] | ID observable-id |<>--{0..*}--[ DetectionConfiguration ] +------------------------+ ]]> The aggregate classes of the DetectionPattern class are: One. SOFTWARE. The application for which the DetectionConfiguration or Description is being provided. Zero or more. ML_STRING. A free-form text description of how to use the information provided in the Application or DetectionConfiguration classes. Zero or more. STRING. A machine-consumable configuration to find a pattern of activity. An instance of either the Description or DetectionConfiguration class MUST be present. The attributes of the DetectionPattern class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See . Optional. ID. See .

The Method class describes the tactics, techniques, procedures, or weakness used by the threat actor in an incident. This class consists of both a list of references describing the attack methods and weaknesses and a free-form text description.

--{0..*}--[ Reference ] | STRING ext-restriction |<>--{0..*}--[ Description ] | |<>--{0..*}--[ sci:AttackPattern ] | |<>--{0..*}--[ sci:Vulnerability ] | |<>--{0..*}--[ sci:Weakness ] | |<>--{0..*}--[ AdditionalData ] +------------------------+ ]]> The aggregate classes of the Method class are: Zero or more. A reference to a vulnerability, malware sample, advisory, or analysis of an attack technique. See . Zero or more. ML_STRING. A free-form text description of techniques, tactics, or procedures used by the threat actor. Zero or more. A reference to a pattern of attack or exploitation per . Zero or more. A reference to a vulnerability per . Zero or more. A reference to the exploited weakness per . Zero or more. EXTENSION. A mechanism by which to extend the data model. An instance of one of these children MUST be present. The attributes of the Method class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The Reference class is an external reference to relevant information such as a vulnerability, IDS alert, malware sample, advisory, or attack technique.

--{0..1}--[ enum:ReferenceName ] | |<>--{0..*}--[ URL ] | |<>--{0..*}--[ Description ] +-------------------------+ ]]> The aggregate classes of the Reference class are: Zero or one. Reference identifier per . Zero or more. URL. A URL to a reference. Zero or more. ML_STRING. A free-form text description of this reference. At least one of these classes MUST be present. The attribute of the Reference class is: Optional. ID. See .

The Assessment class describes the repercussions of the incident to the victim.

--{0..*}--[ IncidentCategory ] | ENUM restriction |<>--{0..*}--[ SystemImpact ] | STRING ext-restriction |<>--{0..*}--[ BusinessImpact ] | ID observable-id |<>--{0..*}--[ TimeImpact ] | |<>--{0..*}--[ MonetaryImpact ] | |<>--{0..*}--[ IntendedImpact ] | |<>--{0..*}--[ Counter ] | |<>--{0..*}--[ MitigatingFactor ] | |<>--{0..*}--[ Cause ] | |<>--{0..1}--[ Confidence ] | |<>--{0..*}--[ AdditionalData ] +-------------------------+ ]]> The aggregate classes of the Assessment class are: Zero or more. ML_STRING. A free-form text description categorizing the type of incident. Zero or more. A technical characterization of the impact of the incident activity on the victim's enterprise. See . Zero or more. Impact of the incident activity on the business functions of the victim organization. See . Zero or more. A characterization of the victim organization due to the incident activity as a function of time. See . Zero or more. The financial loss due to the incident activity. See . Zero or more. The intended outcome to the victim sought by the threat actor. Defined identically to the BusinessImpact defined in but describes intent rather than the realized impact. Zero or more. A counter with which to summarize the magnitude of the activity. See . Zero or more. ML_STRING. A description of a mitigating factor relative to the impact on the victim organization. Zero or more. ML_STRING. A description of an underlying cause of the impact. Zero or one. An estimate of confidence in the impact assessment. See . Zero or more. EXTENSION. A mechanism by which to extend the data model. At least one instance of the possible five impact classes (i.e., SystemImpact, BusinessImpact, TimeImpact, MonetaryImpact, or IntendedImpact) MUST be present. The attributes of the Assessment class are: Optional. ENUM. Specifies whether the assessment is describing actual or potential outcomes. actual. This assessment describes activity that has occurred. potential. This assessment describes potential activity that might occur. Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See . Optional. ID. See .

The SystemImpact class describes the technical impact of the incident to the systems on the network.

--{0..*}--[ Description ] | ENUM completion | | ENUM type | | STRING ext-type | +-----------------------+ ]]> The aggregate class of the SystemImpact class is: Zero or more. ML_STRING. A free-form text description of the impact to the system. The attributes of the SystemImpact class are: Optional. ENUM. An estimate of the relative severity of the activity. The permitted values are shown below. There is no default value. low. Low severity medium. Medium severity high. High severity Optional. ENUM. An indication whether the described activity was successful. The permitted values are shown below. There is no default value. failed. The attempted activity was not successful. succeeded. The attempted activity succeeded. Required. ENUM. Classifies the impact. The permitted values are shown below. The default value is "unknown". These values are maintained in the "SystemImpact-type" IANA registry per . takeover-account. Control was taken of a given account. takeover-service. Control was taken of a given service. takeover-system. Control was taken of a given system. cps-manipulation. A cyber-physical system was manipulated. cps-damage. A cyber-physical system was damaged. availability-data. Access to particular data was degraded or denied. availability-account. Access to an account was degraded or denied. availability-service. Access to a service was degraded or denied. availability-system. Access to a system was degraded or denied. damaged-system. Hardware on a system was irreparably damaged. damaged-data. Data on a system was deleted. breach-proprietary. Sensitive or proprietary information was accessed or exfiltrated. breach-privacy. Personally identifiable information was accessed or exfiltrated. breach-credential. Credential information was accessed or exfiltrated. breach-configuration. System configuration or data inventory was access or exfiltrated. integrity-data. Data on the system was modified. integrity-configuration. Application or system configuration was modified. integrity-hardware. Firmware of a hardware component was modified. traffic-redirection. Network traffic on the system was redirected monitoring-traffic. Network traffic emerging from a host or enclave was monitored. monitoring-host. System activity (e.g., running processes, keystrokes) were monitored. policy. Activity violated the system owner's acceptable use policy. unknown. The impact is unknown. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the type attribute. See .

The BusinessImpact class describes and characterizes the degree to which the function of the organization was impacted by the incident.

--{0..*}--[ Description ] | STRING ext-severity | | ENUM type | | STRING ext-type | +-------------------------+ ]]> The aggregate class of the BusinessImpact class is: Zero or more. ML_STRING. A free-form text description of the impact to the organization. The attributes of the BusinessImpact class are: Optional. ENUM. Characterizes the severity of the incident on business functions. The permitted values are shown below. They were derived from Table 3-2 of . The default value is "unknown". These values are maintained in the "BusinessImpact-severity" IANA registry per . none. No effect to the organization's ability to provide all services to all users. low. Minimal effect as the organization can still provide all critical services to all users but has lost efficiency. medium. The organization has lost the ability to provide a critical service to a subset of system users. high. The organization is no longer able to provide some critical services to any users. unknown. The impact is not known. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the severity attribute. See . Required. ENUM. Characterizes the effect this incident had on the business. The permitted values are shown below. The default value is "unknown". These values are maintained in the "BusinessImpact-type" IANA registry per . breach-proprietary. Sensitive or proprietary information was accessed or exfiltrated. breach-privacy. Personally identifiable information was accessed or exfiltrated. breach-credential. Credential information was accessed or exfiltrated. loss-of-integrity. Sensitive or proprietary information was changed or deleted. loss-of-service. Service delivery was disrupted. theft-financial. Money was stolen. theft-service. Services were misappropriated. degraded-reputation. The reputation of the organization's brand was diminished. asset-damage. A cyber-physical system was damaged. asset-manipulation. A cyber-physical system was manipulated. legal. The incident resulted in legal or regulatory action. extortion. The incident resulted in actors extorting the victim organization. unknown. The impact is unknown. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the type attribute. See .

The TimeImpact class describes the impact of the incident on an organization as a function of time. It provides a way to convey down time and recovery time.

The content of the class is of type REAL and specifies an amount of time. The duration attribute provides units for this content, and the metric attribute explains what this content is measuring. The attributes of the TimeImpact class are: Optional. ENUM. An estimate of the relative severity of the activity. The permitted values are shown below. There is no default value. low. Low severity medium. Medium severity high. High severity Required. ENUM. Defines the meaning of the value in the element content. These values are maintained in the "TimeImpact-metric" IANA registry per . labor. Total staff time to recovery from the activity (e.g., 2 employees working 4 hours each would be 8 hours). elapsed. Elapsed time from the beginning of the recovery to its completion (i.e., wall-clock time). downtime. Duration of time for which some provided service(s) was not available. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the metric attribute. See . Optional. ENUM. Defines the unit of time for the value in the element content. The default value is "hour". These values are maintained in the "TimeImpact-duration" IANA registry per . second. The unit of the element content is seconds. minute. The unit of the element content is minutes. hour. The unit of the element content is hours. day. The unit of the element content is days. month. The unit of the element content is months. quarter. The unit of the element content is quarters. year. The unit of the element content is years. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the duration attribute. See .

The MonetaryImpact class describes the financial impact of the activity on an organization. For example, this impact may consider losses due to the cost of the investigation or recovery, diminished productivity of the staff, or a tarnished reputation that will affect future opportunities.

The content of the class is of type REAL and specifies a quantity of money. The currency attribute defines the currency of this value. The attributes of the MonetaryImpact class are: Optional. ENUM. An estimate of the relative severity of the activity. The permitted values are shown below. There is no default value. low. Low severity medium. Medium severity high. High severity Optional. STRING. Defines the currency in which the value in the element content is expressed. The permitted values are defined in "Codes for the representation of currencies" . There is no default value.

The Confidence class represents an estimate of the validity and accuracy of data expressed in the document. This estimate can be expressed as a category or a numeric calculation.

The content of the class is of type REAL and specifies a numerical assessment in the confidence of the data when the value of the rating attribute is "numeric". Otherwise, this element MUST be empty. The attributes of the Confidence class are: Required. ENUM. A qualitative assessment of confidence. These values are maintained in the "Confidence-rating" IANA registry per low. Low confidence. medium. Medium confidence. high. High confidence. numeric. The element content contains a number that conveys the confidence of the data. The semantics of this number is outside the scope of this specification. unknown. The confidence rating value is not known. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the rating attribute. See .

The History class is a log of the significant events or actions performed by the involved parties during the course of handling the incident. The level of detail maintained in this log is left up to the discretion of those handling the incident.

--{1..*}--[ HistoryItem ] | STRING ext-restriction | +------------------------+ ]]> The aggregate classes of the History class are: One or more. An entry in the history log of significant events or actions performed by the involved parties. See . The attributes of the History class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The HistoryItem class is an entry in the History log that documents a particular action or event that occurred in the course of handling the incident. The details of the entry are a free-form text description, but each can be categorized with the type attribute.

----------[ DateTime ] | STRING ext-action |<>--{0..1}--[ IncidentID ] | ENUM restriction |<>--{0..1}--[ Contact ] | STRING ext-restriction |<>--{0..*}--[ Description ] | ID observable-id |<>--{0..*}--[ DefinedCOA ] | |<>--{0..*}--[ AdditionalData ] +-------------------------+ ]]> The aggregate classes of the HistoryItem class are: One. DATETIME. A timestamp of this entry in the history log. Zero or one. In a history log created by multiple parties, the IncidentID provides a mechanism to specify which CSIRT created a particular entry and references this organization's tracking number. When a single organization is maintaining the log, this class can be ignored. See . Zero or one. Provides contact information for the entity that performed the action documented in this class. See . Zero or more. ML_STRING. A free-form text description of the action or event. Zero or more. STRING. An identifier meaningful to the sender and recipient of this document that references a course of action (COA). This class MUST be present if the action attribute is set to "defined-coa". Zero or more. EXTENSION. A mechanism by which to extend the data model. The attributes of the HistoryItem class are: Required. ENUM. Classifies a performed action or occurrence documented in this history log entry. As activity will likely have been instigated either through a previously conveyed expectation or through an internal investigation, this attribute is identical to the action attribute of the Expectation class. The difference is only one of tense. When an action is in this class, it has been completed. See . Optional. STRING. A means by which to extend the action attribute. See . Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See . Optional. ID. See .

The EventData class is a container class to organize data about events that occurred during an incident.

--{0..*}--[ Description ] | STRING ext-restriction |<>--{0..1}--[ DetectTime ] | ID observable-id |<>--{0..1}--[ StartTime ] | |<>--{0..1}--[ EndTime ] | |<>--{0..1}--[ RecoveryTime ] | |<>--{0..1}--[ ReportTime ] | |<>--{0..*}--[ Contact ] | |<>--{0..*}--[ Discovery ] | |<>--{0..1}--[ Assessment ] | |<>--{0..*}--[ Method ] | |<>--{0..*}--[ Flow ] | |<>--{0..*}--[ Expectation ] | |<>--{0..1}--[ Record ] | |<>--{0..*}--[ EventData ] | |<>--{0..*}--[ AdditionalData ] +-------------------------+ ]]> The aggregate classes of the EventData class are: Zero or more. ML_STRING. A free-form text description of the event. Zero or one. DATETIME. The time the event was detected. Zero or one. DATETIME. The time the event started. Zero or one. DATETIME. The time the event ended. Zero or one. DATETIME. The time the site recovered from the event. Zero or one. DATETIME. The time the event was reported. Zero or more. Contact information for the parties involved in the event. See . Zero or more. The means by which the event was detected. See . Zero or one. The impact of the event on the victim and the actions taken. See . Zero or more. The technique used by the threat actor in the event. See . Zero or more. A description of the systems or networks involved. See . Zero or more. The expected action to be performed by the recipient for the described event. See . Zero or one. Supportive data (e.g., log files) that provides additional information about the event. See . Zero or more. A recursive definition of the EventData class. See for an explanation on using this class. Zero or more. EXTENSION. An extension mechanism for data not explicitly represented in the data model. At least one of the aggregate classes MUST be present in an instance of the EventData class. The attributes of the EventData class are: Optional. ENUM. See . The default value is "default". Optional. STRING. A means by which to extend the restriction attribute. See . Optional. ID. See .

There is substantial overlap in the child classes aggregated in the Incident and EventData classes. Nevertheless, the semantics of these classes are quite different. The Incident class provides summary information about the entire incident, while the EventData class provides information about the individual events comprising the incident. In the common case, the EventData class will provide more specific information for the general description provided in the Incident class. However, in the case where the summarized information in the Incident class conflicts with the detailed information in an EventData class, the more specific EventData class MUST supersede the more generic information provided in the Incident class.

The EventData class is a container for the properties of an event in an incident. These properties include: the hosts involved, impact of the incident activity on the hosts, forensic logs, etc. The recursive definition of EventData allows for the grouping of related information with common properties. This approach eliminates the need for explicit identifiers to relate information or duplicate it. Instead, the relative depth (nesting) of a class is used to group (relate) information. For example, consider a case where two hosts experience different impacts during an incident. However, these two hosts have common contact information. A depiction of how this situation would be represented can be found in . EventData (2) and (3) group each of the two hosts with their unique impact. EventData (1) describes the common Contact class these two hosts share.

The Expectation class conveys to the recipient of the IODEF document the actions the sender is requesting.

--{0..*}--[ Description ] | STRING ext-action |<>--{0..*}--[ DefinedCOA ] | ENUM severity |<>--{0..1}--[ StartTime ] | ENUM restriction |<>--{0..1}--[ EndTime ] | STRING ext-restriction |<>--{0..1}--[ Contact ] | ID observable-id | +-------------------------+ ]]> The aggregate classes of the Expectation class are: Zero or more. ML_STRING. A free-form text description of the desired action(s). Zero or more. STRING. A unique identifier meaningful to the sender and recipient of this document that references a course of action. This class MUST be present if the action attribute is set to "defined-coa". Zero or one. DATETIME. The time at which the sender would like the action performed. A timestamp that is earlier than the ReportTime specified in the Incident class denotes that the sender would like the action performed as soon as possible. The absence of this element indicates no expectations of when the recipient would like the action performed. Zero or one. DATETIME. The time by which the sender expects the recipient to complete the action. If the recipient cannot complete the action before EndTime, the recipient MUST NOT carry out the action. Because of transit delays and clock drift, the sender MUST be prepared for the recipient to have carried out the action, even if it completes past EndTime. Zero or one. The entity expected to perform the action. See . The attributes of the Expectation class are: Optional. ENUM. Classifies the type of action requested. The default value of "other". These values are maintained in the "Expectation-action" IANA registry per . nothing. No action is requested. Do nothing with the information. contact-source-site. Contact the site(s) identified as the source of the activity. contact-target-site. Contact the site(s) identified as the target of the activity. contact-sender. Contact the originator of the document. investigate. Investigate the system(s) listed in the event. block-host. Block traffic from the machine(s) listed as sources in the event. block-network. Block traffic from the network(s) lists as sources in the event. block-port. Block the port listed as sources in the event. rate-limit-host. Rate-limit the traffic from the machine(s) listed as sources in the event. rate-limit-network. Rate-limit the traffic from the network(s) lists as sources in the event. rate-limit-port. Rate-limit the port(s) listed as sources in the event. redirect-traffic. Redirect traffic from the intended recipient for further analysis. honeypot. Redirect traffic from systems listed in the event to a honeypot for further analysis. upgrade-software. Upgrade or patch the software or firmware on an asset listed in the event. rebuild-asset. Reinstall the operating system or applications on an asset listed in the event. harden-asset. Change the configuration of an asset listed in the event to reduce the attack surface. remediate-other. Remediate the activity in a way other than by rate-limiting or blocking. status-triage. Confirm receipt and begin triaging the incident. status-new-info. Notify the sender when new information is received for this incident. watch-and-report. Watch for the described activity or indicators, and notify the sender when seen. training. Train user to identify or mitigate the described threat. defined-coa. Perform a predefined course of action (COA). The COA is named in the DefinedCOA class. other. Perform a custom action described in the Description class. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the action attribute. See . Optional. ENUM. Indicates the desired priority of the action. This attribute is an enumerated list with no default value, and the semantics of these relative measures are context dependent. low. Low priority medium. Medium priority high. High priority Optional. ENUM. See . The default value is "default". Optional. STRING. A means by which to extend the restriction attribute. See . Optional. ID. See .

The Flow class describes the systems and networks involved in the incident and the relationships between them.

--{1..*}--[ System ] +------------------+ ]]> The aggregate class of the Flow class is: One or More. A host or network involved in an event. See . The Flow class has no attributes.

The System class describes a system or network involved in an event.

----------[ Node ] | STRING ext-category |<>--{0..*}--[ NodeRole ] | STRING interface |<>--{0..*}--[ Service ] | ENUM spoofed |<>--{0..*}--[ OperatingSystem ] | ENUM virtual |<>--{0..*}--[ Counter ] | ENUM ownership |<>--{0..*}--[ AssetID ] | STRING ext-ownership |<>--{0..*}--[ Description ] | ENUM restriction |<>--{0..*}--[ AdditionalData ] | STRING ext-restriction | | ID observable-id | +------------------------+ ]]> The aggregate classes of the System class are: One. A host or network involved in the incident. See . Zero or more. The intended purpose of the system. See . Zero or more. A network service running on the system. See . Zero or more. SOFTWARE. The operating system running on the system. Zero or more. A counter with which to summarize properties of this host or network. See . Zero or more. STRING. An asset identifier for the System. Zero or more. ML_STRING. A free-form text description of the System. Zero or more. EXTENSION. A mechanism by which to extend the data model. The attributes of the System class are: Optional. ENUM. Classifies the role the host or network played in the incident. These values are maintained in the "System-category" IANA registry per . source. The System was the source of the event. target. The System was the target of the event. intermediate. The System was an intermediary in the event. sensor. The System was a sensor monitoring the event. infrastructure. The System was an infrastructure node of the IODEF document exchange. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the category attribute. See . Optional. STRING. Specifies the interface on which the event(s) on this System originated. If the Node class specifies a network rather than a host, this attribute has no meaning. Optional. ENUM. An indication of confidence in whether this System was the true target or attacking host. The permitted values for this attribute are shown below. The default value is "unknown". unknown. The accuracy of the category attribute value is unknown. yes. The category attribute value is likely incorrect. In the case of a source, the System is likely a decoy; with a target, the System was likely not the intended victim. no. The category attribute value is believed to be correct. Optional. ENUM. Indicates whether this System is a virtual or physical device. The default value is "unknown". yes. The System is a virtual device. no. The System is a physical device. unknown. It is not known if the System is virtual. Optional. ENUM. Describes the ownership of this System relative to the victim in the incident. These values are maintained in the "System-ownership" IANA registry per . organization. Corporate or enterprise owned. personal. Personally owned by an employee or affiliate of the corporation or enterprise. partner. Owned by a partner of the corporation or enterprise. customer. Owned by a customer of the corporation or enterprise. no-relationship. Owned by an entity that has no known relationship with the victim organization. unknown. Ownership is unknown. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the ownership attribute. See . Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See . Optional. ID. See .

The Node class identifies a system, asset, or network and its location.

--{0..*}--[ DomainData ] | |<>--{0..*}--[ Address ] | |<>--{0..1}--[ PostalAddress ] | |<>--{0..*}--[ Location ] | |<>--{0..*}--[ Counter ] +---------------+ ]]> The aggregate classes of the Node class are: Zero or more. The domain (DNS) information associated with this node. If an Address is not provided, at least one DomainData MUST be specified. See . Zero or more. The hardware, network, or application address of the node. If a DomainData is not provided, at least one Address MUST be specified. See . Zero or one. POSTAL. The postal address of the node. Zero or more. ML_STRING. A free-form text description of the physical location of the node. This description may provide a more detailed description of where at the address specified by the PostalAddress class this node is found (e.g., room number, rack number, or slot number in a chassis). Zero or more. A counter with which to summarize properties of this host or network. See . The Node class has no attributes.

The Address class represents a hardware (Layer 2), network (Layer 3), or application (Layer 7) address.

The content of the class is an address of type STRING whose semantics are determined by the category attribute. The attributes of the Address class are: Required. ENUM. The type of address represented. The default value is "ipv6-addr". These values are maintained in the "Address-category" IANA registry per . asn. Autonomous System Number. atm. Asynchronous Transfer Mode (ATM) address. e-mail. Email address, per the EMAIL data type. ipv4-addr. IPv4 host address in dotted-decimal notation (i.e., a.b.c.d). ipv4-net. IPv4 network address in dotted-decimal notation, slash, significant bits (i.e., a.b.c.d/nn). ipv4-net-masked. A sanitized IPv4 address with significant bits per "ipv4-net" but with the character 'x' replacing any digit(s) in the address or prefix. ipv4-net-mask. IPv4 network address in dotted-decimal notation, slash, network mask in dotted-decimal notation (i.e., a.b.c.d/w.x.y.z). ipv6-addr. IPv6 host address per Section 4 of . ipv6-net. IPv6 network address, slash, prefix per Section 2.3 of . ipv6-net-masked. A sanitized IPv6 address and prefix per "ipv6-net" but with the character 'x' replacing any hexadecimal digit(s) in the address or digit(s) in the prefix. mac. Media Access Control (MAC) address (i.e., aa:bb:cc:dd:ee:ff). site-uri. A URL or URI for a resource, per the URL data type. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the category attribute. See . Optional. STRING. The name of the Virtual LAN to which the address belongs. Optional. INTEGER. The number of the Virtual LAN to which the address belongs. Optional. ID. See .

The NodeRole class describes the function performed by or role of a particular system, asset, or network.

--{0..*}--[ Description ] | STRING ext-category | +-----------------------+ ]]> The aggregate class of the NodeRole class is: Zero or more. ML_STRING. A free-form text description of the role of the system. The attributes of the NodeRole class are: Required. ENUM. Function or role of a node. These values are maintained in the "NodeRole-category" IANA registry per . client. Client computer. client-enterprise. Client computer on the enterprise network. client-partner. Client computer on network of a partner. client-remote. Client computer remotely connected to the enterprise network. client-kiosk. Client computer serving as a kiosk. client-mobile. Mobile device. server-internal. Server with internal services. server-public. Server with public services. www. WWW server. mail. Mail server. webmail. Web mail server. messaging. Messaging server (e.g., NNTP, IRC, IM). streaming. Streaming-media server. voice. Voice server (e.g., SIP, H.323). file. File server. ftp. FTP server. p2p. Peer-to-peer node. name. Name server (e.g., DNS, WINS). directory. Directory server (e.g., LDAP, finger, whois). credential. Credential server (e.g., domain controller, Kerberos). print. Print server. application. Application server. database. Database server. backup. Backup server. dhcp. DHCP server. assessment. Assessment server (e.g., vulnerability scanner, endpoint assessment). source-control. Source code control server. config-management. Configuration management server. monitoring. Security monitoring server (e.g., IDS). infra. Infrastructure server (e.g., router, firewall, DHCP). infra-firewall. Firewall. infra-router. Router. infra-switch. Switch. camera. Camera and video system. proxy. Proxy server. remote-access. Remote access server. log. Log server (e.g., syslog). virtualization. Server running virtual machines. pos. Point-of-sale device. scada. Supervisory control and data acquisition (SCADA) system. scada-supervisory. Supervisory system for a SCADA. sinkhole. Traffic sinkhole destination. honeypot. Honeypot server. anonymization. Anonymization server (e.g., Tor node). c2-server. Malicious command and control server. malware-distribution. Server that distributes malware drop-server. Server to which exfiltrated content is uploaded. hop-point. Intermediary server used to get to a victim. reflector. A system used in a reflector attack. phishing-site. Site hosting phishing content. spear-phishing-site. Site hosting spear-phishing content. recruiting-site. Site to recruit. fraudulent-site. Fraudulent site. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the category attribute. See .

The Counter class summarizes multiple occurrences of an event or conveys counts or rates of various features. The complete semantics of this class are context dependent based on the class in which it is aggregated.

The content of the class is a value of type REAL whose meaning and units are determined by the type and duration attributes, respectively. If the duration attribute is present, the element content is a rate. Otherwise, it is a simple counter. The attributes of the Counter class are: Required. ENUM. Specifies the type of counter specified in the element content. These values are maintained in the "Counter-type" IANA registry per . count. The Counter class value is a counter. peak. The Counter class value is a peak value. average. The Counter class value is an average. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the type attribute. See . Required. ENUM. Specifies the units of the element content. These values are maintained in the "Counter-unit" IANA registry per . byte. Bytes transferred. mbit. Megabits (Mbits) transferred. packet. Packets. flow. Network flow records. session. Sessions. alert. Notifications generated by another system (e.g., IDS or SIEM system). message. Messages (e.g., mail messages). event. Events. host. Hosts. site. Site. organization. Organizations. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the unit attribute. See . Optional. STRING. A free-form text description of the metric represented by the Counter. Optional. ENUM. If present, the Counter class represents a rate. This attribute specifies a unit of time over which the rate whose units are specified in the unit attribute is being conveyed. This attribute is the denominator of the rate (where the unit attribute specified the nominator). The possible values of this attribute are defined in the duration attribute of Optional. STRING. A means by which to extend the duration attribute. See .

The DomainData class describes a domain name and metadata associated with this domain.

----------[ Name ] | STRING ext-system-status |<>--{0..1}--[ DateDomainWasChecked ] | ENUM domain-status |<>--{0..1}--[ RegistrationDate ] | STRING ext-domain-status |<>--{0..1}--[ ExpirationDate ] | ID observable-id |<>--{0..*}--[ RelatedDNS ] | |<>--{0..*}--[ Nameservers ] | |<>--{0..1}--[ DomainContacts ] +--------------------------+ ]]> The aggregate classes of the DomainData class are: One. STRING. The domain name of a system. Zero or one. DATETIME. A timestamp of when the domain listed in the Name class was resolved. Zero or one. DATETIME. A timestamp of when domain listed in the Name class was registered. Zero or one. DATETIME. A timestamp of when the domain listed in the Name class is set to expire. Zero or more. EXTENSION. Additional DNS records associated with this domain. Zero or more. The nameservers identified for the domain listed in the Name class. See . Zero or one. Contact information for the domain listed in the Name class supplied by the registrar or through a whois query. The attributes of the DomainData class are: Required. ENUM. Assesses the domain's involvement in the event. These values are maintained in the "DomainData-system-status" IANA registry per . spoofed. This domain was spoofed. fraudulent. This domain was operated with fraudulent intentions. innocent-hacked. This domain was compromised by a third party. innocent-hijacked. This domain was deliberately hijacked. unknown. No categorization for this domain known. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the system-status attribute. See . Required. ENUM. Categorizes the registry status of the domain at the time the document was generated. These values and their associated descriptions are derived from Section 3.2.2 of . These values are maintained in the "DomainData&nbhy;domain&nbhy;status" IANA registry per . reservedDelegation. The domain is permanently inactive. assignedAndActive. The domain is in a normal state. assignedAndInactive. The domain has an assigned registration, but the delegation is inactive. assignedAndOnHold. The domain is in dispute. revoked. The domain is in the process of being purged from the database. transferPending. The domain is pending a change in authority. registryLock. The domain is on hold by the registry. registrarLock. Same as "registryLock". other. The domain has a known status, but it is not one of the redefined enumerated values. unknown. The domain has an unknown status. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the domain-status attribute. See . Optional. ID. See .

The Nameservers class describes the nameservers associated with a given domain.

----------[ Server ] | |<>--{1..*}--[ Address ] +--------------------+ ]]> The aggregate classes of the Nameservers class are: One. STRING. The domain name of the nameserver. One or more. The address of the nameserver. The value of the category attribute MUST be either "ipv4-addr" or "ipv6-addr". See . The Nameservers class has no attributes.

The DomainContacts class describes the contact information for a given domain provided either by the registrar or through a whois query. This contact information can be explicitly described through a Contact class, or a reference can be provided to a domain with identical contact information. Either a single SameDomainContact or one or more Contact classes MUST be present.

--{0..1}--[ SameDomainContact ] | |<>--{1..*}--[ Contact ] +--------------------+ ]]> The aggregate classes of the DomainContacts class are: Zero or one. STRING. A domain name already cited in this document or through previous exchange that contains the identical contact information as the domain name in question. The domain contact information associated with this domain should be used instead of an explicit definition with the Contact class. One or more. Contact information for the domain. See . The DomainContacts class has no attributes.

The Service class describes a network service. The service is described by a protocol, port, protocol header field, and application providing or using the service.

--{0..1}--[ ServiceName ] | ID observable-id |<>--{0..1}--[ Port ] | |<>--{0..1}--[ Portlist ] | |<>--{0..1}--[ ProtoCode ] | |<>--{0..1}--[ ProtoType ] | |<>--{0..1}--[ ProtoField ] | |<>--{0..1}--[ ApplicationHeader ] | |<>--{0..1}--[ EmailData ] | |<>--{0..1}--[ Application ] +-------------------------+ ]]> The aggregate classes of the Service class are: Zero or one. A protocol name. Zero or one. INTEGER. A port number. Zero or one. PORTLIST. A list of port numbers. Zero or one. INTEGER. A transport-layer (Layer 4) protocol-specific code field (e.g., ICMP code field). Zero or one. INTEGER. A transport-layer (Layer 4) protocol-specific type field (e.g., ICMP type field). Zero or one. INTEGER. A transport-layer (Layer 4) protocol-specific flag field (e.g., TCP flag field). Zero or one. A protocol header. See . Zero or one. Headers associated with an email message. See . Zero or one. SOFTWARE. The application acting as either the client or the server for the service. At least one of these classes MUST be present. When a given System class with category="source" and another with category="target" are aggregated into a single Flow class, and each of these System classes has a Service and Portlist class, an implicit relationship between these Portlists exists. If N ports are listed for a System@category="source", and M ports are listed for System@category="target", the number of ports in N must be equal to M. Likewise, the ports MUST be listed in an identical sequence such that the n-th port in the source corresponds to the n-th port of the target. If N is greater than 1, a given instance of a Flow class MUST only have a single instance of a System@category="source" and System@category="target". The attributes of the Service class are: Optional. INTEGER. The IANA-assigned IP protocol number per . The attribute MUST be set if a Port, Portlist, ProtoCode, ProtoType, or ProtoField class is present. Optional. ID. See .

The ServiceName class identifies an application protocol. It can be described by referencing an IANA-registered protocol, by referencing a URL, or with free-form text.

--{0..1}--[ IANAService ] | |<>--{0..*}--[ URL ] | |<>--{0..*}--[ Description ] +--------------------+ ]]> The aggregate classes of the ServiceName class are: Zero or one. STRING. The name of the service per the "Service Name" field of the registry . Zero or more. URL. A URL to a resource describing the service. Zero or more. ML_STRING. A free-form text description of the service. At least one of these classes MUST be present. The ServiceName class has no attributes.

The ApplicationHeader class describes arbitrary fields from a protocol header and its corresponding value.

--{1..*}--[ ApplicationHeaderField ] +--------------------------+ ]]> The aggregate class of the ApplicationHeader class is: One or more. EXTENSION. A field name and value in a protocol header. The name attribute MUST be set to the field name. The field value MUST be set in the element content. The ApplicationHeader class has no attributes.

The EmailData class describes headers from an email message and cryptographic hashes and signatures applied to it.

--{0..*}--[ EmailTo ] | |<>--{0..1}--[ EmailFrom ] | |<>--{0..1}--[ EmailSubject ] | |<>--{0..1}--[ EmailX-Mailer ] | |<>--{0..*}--[ EmailHeaderField ] | |<>--{0..1}--[ EmailHeaders ] | |<>--{0..1}--[ EmailBody ] | |<>--{0..1}--[ EmailMessage ] | |<>--{0..*}--[ HashData ] | |<>--{0..*}--[ SignatureData ] +-------------------------+ ]]> The aggregate classes of the EmailData class are: Zero or more. EMAIL. The value of the "To:" header field (Section 3.6.3 of ) in an email. Zero or one. EMAIL. The value of the "From:" header field (Section 3.6.2 of ) in an email. Zero or one. STRING. The value of the "Subject:" header field in an email. See Section 3.6.5 of . Zero or one. STRING. The value of the "X-Mailer:" header field in an email. Zero or more. EXTENSION. The header name and value of an arbitrary header field of the email message. The name attribute MUST be set to the header name. The header value MUST be set in the element body. The dtype attribute MUST be set to "string". Zero or one. STRING. The headers of an email message. Zero or one. STRING. The body of an email message. Zero or one. STRING. The headers and body of an email message. Zero or more. Hash(es) associated with this email message. See . Zero or more. Signature(s) associated with this email message. See . The attribute of the EmailData class is: Optional. ID. See .

The Record class is a container class for log and audit data that provides supportive information about the events in an incident. The source of this data will often be the output of monitoring tools. These logs substantiate the activity described in the document.

--{1..*}--[ RecordData ] | STRING ext-restriction | +------------------------+ ]]> The aggregate classes of the Record class are: One or more. Log or audit data generated by a particular tool. Separate instances of the RecordData class SHOULD be used for each type of log. See . The attributes of the Record class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The RecordData class describes or references log or audit data from a given type of tool and provides a means to annotate the output.

--{0..1}--[ DateTime ] | STRING ext-restriction |<>--{0..*}--[ Description ] | ID observable-id |<>--{0..1}--[ Application ] | |<>--{0..*}--[ RecordPattern ] | |<>--{0..*}--[ RecordItem ] | |<>--{0..*}--[ URL ] | |<>--{0..*}--[ FileData ] | |<>--{0..*}-- | | [ WindowsRegistryKeysModified ] | |<>--{0..*}--[ CertificateData ] | |<>--{0..*}--[ AdditionalData ] +------------------------+ ]]> The aggregate classes of the RecordData class are: Zero or one. DATETIME. A timestamp of the data found in the RecordItem or URL classes. Zero or more. ML_STRING. A free-form text description of the data provided in the RecordItem or URL classes. Zero or one. SOFTWARE. Identifies the tool used to generate the data in the RecordItem or URL classes. Zero or more. A search string to precisely find the relevant data in the RecordItem or URL classes. See . Zero or more. EXTENSION. Log, audit, or forensic data to support the conclusions made during the course of analyzing the incident. Zero or more. URL. A URL reference to a log or audit data. Zero or one. The files involved in the incident. See . Zero or more. The registry keys that were involved in the incident. See . Zero or more. The certificates that were involved in the incident. See . Zero or more. EXTENSION. An extension mechanism for data not explicitly represented in the data model. At least one of the following classes MUST be present: RecordItem, URL, FileData, WindowsRegistryKeysModified, CertificateData, or AdditionalData. The attributes of the RecordData class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See . Optional. ID. See .

The RecordPattern class describes where in the log data provided or referenced in the RecordData class relevant information can be found. It provides a way to reference subsets of information, identified by a pattern, in a large log file, audit trail, or forensic data.

The content of the class is of type STRING and specifies a search pattern. The attributes of the RecordPattern class are: Required. ENUM. Describes the type of pattern being specified in the element content. The default is "regex". These values are maintained in the "RecordPattern-type" IANA registry per . regex. Regular expression as defined by POSIX Extended Regular Expressions (ERE) in Chapter 9 of . binary. Binhex-encoded binary pattern, per the HEXBIN data type. xpath. XML Path (XPath) . ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the type attribute. See . Optional. INTEGER. Amount of units (determined by the offsetunit attribute) to seek into the RecordItem data before matching the pattern. Optional. ENUM. Describes the units of the offset attribute. The default is "line". These values are maintained in the "RecordPattern-offsetunit" IANA registry per . line. Offset is a count of lines. byte. Offset is a count of bytes. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the offsetunit attribute. See . Optional. INTEGER. Number of times to apply the specified pattern.

The WindowsRegistryKeysModified class describes Windows operating system registry keys and the operations that were performed on them. This class was derived from .

--{1..*}--[ Key ] +-----------------------------+ ]]> The aggregate classes of the WindowsRegistryKeysModified class are: One or more. The Windows registry key. See . The attribute of the WindowsRegistryKeysModified class is: Optional. ID. See .

The Key class describes a Windows operating system registry key name and value pair, as well as the operation performed on it.

----------[ KeyName ] | STRING ext-registryaction |<>--{0..1}--[ KeyValue ] | ID observable-id | +---------------------------+ ]]> The aggregate classes of the Key class are: One. STRING. The name of a Windows operating system registry key (e.g., [HKEY_LOCAL_MACHINE\Software\Test\KeyName]). Zero or one. STRING. The value of the registry key identified in the KeyName class encoded per the .reg file format . The attributes of the Key class are: Optional. ENUM. The type of action taken on the registry key. These values are maintained in the "Key-registryaction" IANA registry per . add-key. Registry key added. add-value. Value added to a registry key. delete-key. Registry key deleted. delete-value. Value deleted from a registry key. modify-key. Registry key modified. modify-value. Value modified in a registry key. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the registryaction attribute. See . Optional. ID. See .

The CertificateData class describes X.509 certificates.

--{1..*}--[ Certificate ] | STRING ext-restriction | | ID observable-id | +------------------------+ ]]> The aggregate classes of the CertificateData class are: One or more. A description of an X.509 certificate or certificate chain. See . The attributes of the CertificateData class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See . Optional. ID. See .

The Certificate class describes a given X.509 certificate or certificate chain.

----------[ ds:X509Data ] | |<>--{0..*}--[ Description ] +--------------------------+ ]]> The aggregate classes of the Certificate class are: One. A given X.509 certificate or chain. See Section 4.4.4 of . Zero or more. ML_STRING. A free-form text description explaining the context of this certificate. The attributes of the Certificate class are: Optional. ID. See .

The FileData class describes a file or set of files.

--{1..*}--[ File ] | STRING ext-restriction | | ID observable-id | +------------------------+ ]]> The aggregate classes of the FileData class are: One or more. A description of a file. See . The attributes of the FileData class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See . Optional. ID. See .

The File class describes a file; its associated metadata; and cryptographic hashes and signatures applied to it.

--{0..1}--[ FileName ] | |<>--{0..1}--[ FileSize ] | |<>--{0..1}--[ FileType ] | |<>--{0..*}--[ URL ] | |<>--{0..1}--[ HashData ] | |<>--{0..1}--[ SignatureData ] | |<>--{0..1}--[ AssociatedSoftware ] | |<>--{0..*}--[ FileProperties ] +-----------------------+ ]]> The aggregate classes of the File class are: Zero or one. STRING. The name of the file. Zero or one. INTEGER. The size of the file in bytes. Zero or one. STRING. The type of file per the IANA "Media Types" registry . Valid values correspond to the text in the "Template" column (e.g., "application/pdf"). Zero or more. URL. A URL reference to the file. Zero or one. Hash(es) associated with this file. See . Zero or one. Signature(s) associated with this file. See . Zero or one. SOFTWARE. The software application or operating system to which this file belongs or by which it can be processed. Zero or more. EXTENSION. Mechanism by which to extend the data model to describe properties of the file. The attributes of the File class are: Optional. ID. See .

The HashData class describes different types of hashes on a given object (e.g., file, part of a file, email).

--{0..1}--[ HashTargetID ] | |<>--{0..*}--[ Hash ] | |<>--{0..*}--[ FuzzyHash ] +--------------------------+ ]]> The aggregate classes of the HashData class are: Zero or one. STRING. An identifier that references a subset of the object being hashed. The semantics of this identifier are specified by the scope attribute. Zero or more. The hash of an object. See . Zero or more. The fuzzy hash of an object. See . At least one instance of either Hash or FuzzyHash MUST be present. The attribute of the HashData class is: Required. ENUM. Describes on which part of the object the hash should be applied. These values are maintained in the "HashData-scope" IANA registry per . file-contents. A hash computed over the entire contents of a file. file-pe-section. A hash computed on a given section of a Windows Portable Executable (PE) file. If set to this value, the HashTargetID class MUST identify the section being hashed. A section is identified by an ordinal number (starting at 1) corresponding to the order in which the given section header was defined in the Section Table of the PE file header. file-pe-iat. A hash computed on the Import Address Table (IAT) of a PE file. As IAT hashes are often tool dependent, if this value is set, the Application class of either the Hash or FuzzyHash classes MUST specify the tool used to generate the hash. file-pe-resource. A hash computed on a given resource in a PE file. If set to this value, the HashTargetID class MUST identify the resource being hashed. A resource is identified by an ordinal number (starting at 1) corresponding to the order in which the given resource is declared in the Resource Directory of the Data Dictionary in the PE file header. file-pdf-object. A hash computed on a given object in a Portable Document Format (PDF) file. If set to this value, the HashTargetID class MUST identify the object being hashed. This object is identified by its offset in the PDF file. email-hash. A hash computed over the headers and body of an email message. email-headers-hash. A hash computed over all of the headers of an email message. email-body-hash. A hash computed over the body of an email message. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the scope attribute. See .

The Hash class describes a cryptographic hash value; the algorithm and application used to generate it; and the canonicalization method applied to the object being hashed.

----------[ ds:DigestMethod ] | |<>----------[ ds:DigestValue ] | |<>--{0..1}--[ ds:CanonicalizationMethod ] | |<>--{0..1}--[ Application ] +----------------+ ]]> The aggregate classes of the Hash class are: One. The hash algorithm used to generate the hash. See Section 4.3.3.5 of . One. The computed hash value. See Section 4.3.3.6 of . Zero or one. The canonicalization method used on the object being hashed. See Section 4.3.1 of . Zero or one. SOFTWARE. The application used to calculate the hash. The HashData class has no attributes.

The FuzzyHash class describes a fuzzy hash and the application used to generate it.

--{1..*}--[ FuzzyHashValue ] | |<>--{0..1}--[ Application ] | |<>--{0..*}--[ AdditionalData ] +--------------------------+ ]]> The aggregate classes of the FuzzyHash class are: One or more. EXTENSION. The computed fuzzy hash value. Zero or one. SOFTWARE. The application used to calculate the hash. Zero or more. EXTENSION. Mechanism by which to extend the data model. The FuzzyData class has no attributes.

The SignatureData class describes different types of digital signatures on an object.

--{1..*}--[ ds:Signature ] +--------------------------+ ]]> The aggregate class of the SignatureData class is: One or more. A given signature. See Section 4.2 of . The SignatureData class has no attributes.

The IndicatorData class describes indicators and metadata associated with them.

--{1..*}--[ Indicator ] +--------------------------+ ]]> The aggregate class of the IndicatorData class is: One or more. A description of an indicator. See . The IndicatorData class has no attributes.

The Indicator class describes an indicator. An indicator consists of observable features and phenomenon that aid in the forensic or proactive detection of malicious activity and associated metadata. An indicator can be described outright by referencing or composing previously defined indicators or by referencing observables described in the incident report found in this document.

----------[ IndicatorID ] | STRING ext-restriction |<>--{0..*}--[ AlternativeIndicatorID ] | |<>--{0..*}--[ Description ] | |<>--{0..1}--[ StartTime ] | |<>--{0..1}--[ EndTime ] | |<>--{0..1}--[ Confidence ] | |<>--{0..*}--[ Contact ] | |<>--{0..1}--[ Observable ] | |<>--{0..1}--[ ObservableReference ] | |<>--{0..1}--[ IndicatorExpression ] | |<>--{0..1}--[ IndicatorReference ] | |<>--{0..*}--[ NodeRole ] | |<>--{0..*}--[ AttackPhase ] | |<>--{0..*}--[ Reference ] | |<>--{0..*}--[ AdditionalData ] +------------------------+ ]]> The aggregate classes of the Indicator class are: One. An identifier for this indicator. See . Zero or more. An alternative identifier for this indicator. See . Zero or more. ML_STRING. A free-form text description of the indicator. Zero or one. DATETIME. A timestamp of the start of the time period during which this indicator is valid. Zero or one. DATETIME. A timestamp of the end of the time period during which this indicator is valid. Zero or one. An estimate of the confidence in the quality of the indicator. See . Zero or more. Contact information for this indicator. See . Zero or one. An observable feature or phenomenon of this indicator. See . Zero or one. A reference to an observable feature or phenomenon defined elsewhere in the document. See . Zero or one. A composition of observables. See . Zero or one. A reference to an indicator. See . Zero or more. The role of the system in the attack should this indicator be matched to it. See . Zero or more. The phase in an attack life cycle during which this indicator might be seen. See . Zero or more. A reference to additional information relevant to this indicator. See . Zero or more. EXTENSION. Mechanism by which to extend the data model. The Indicator class MUST have exactly one instance of an Observable, IndicatorExpression, ObservableReference, or IndicatorReference class. The StartTime and EndTime classes can be used to define an interval during which the indicator is valid. If both classes are present, the indicator is consider valid only during the described interval. If neither class is provided, the indicator is considered valid during any time interval. If only a StartTime is provided, the indicator is valid anytime after this timestamp. If only an EndTime is provided, the indicator is valid anytime prior to this timestamp. The attributes of the Indicator class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The IndicatorID class identifies an indicator with a globally unique identifier. The combination of the name and version attributes and the element content form this identifier. Indicators generated by given CSIRT MUST NOT reuse the same value unless they are referencing the same indicator.

The content of the class is of type ID and specifies an identifier for an indicator. The attributes of the IndicatorID class are: Required. STRING. An identifier describing the CSIRT that created the indicator. In order to have a globally unique CSIRT name, the fully qualified domain name associated with the CSIRT MUST be used. This format is identical to the IncidentID@name attribute in . Required. STRING. A version number of an indicator.

The AlternativeIndicatorID class lists alternative identifiers for an indicator.

--{1..*}--[ IndicatorReference ] | STRING ext-restriction | +-------------------------+ ]]> The aggregate class of the AlternativeIndicatorID class is: One or more. A reference to an indicator. See . The attributes of the AlternativeIndicatorID class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The Observable class describes a feature and phenomenon that can be observed or measured for the purposes of detecting malicious behavior.

--{0..1}--[ System ] | STRING ext-restriction |<>--{0..1}--[ Address ] | |<>--{0..1}--[ DomainData ] | |<>--{0..1}--[ Service ] | |<>--{0..1}--[ EmailData ] | |<>--{0..1}--[ WindowsRegistryKeysModified ] | |<>--{0..1}--[ FileData ] | |<>--{0..1}--[ CertificateData ] | |<>--{0..1]--[ RegistryHandle ] | |<>--{0..1}--[ RecordData ] | |<>--{0..1}--[ EventData ] | |<>--{0..1}--[ Incident ] | |<>--{0..1}--[ Expectation ] | |<>--{0..1}--[ Reference ] | |<>--{0..1}--[ Assessment ] | |<>--{0..1}--[ DetectionPattern ] | |<>--{0..1}--[ HistoryItem ] | |<>--{0..1}--[ BulkObservable ] | |<>--{0..*}--[ AdditionalData ] +------------------------+ ]]> The aggregate classes of the Observable class are: Zero or one. A System observable. See . Zero or one. An Address observable. See . Zero or one. A DomainData observable. See . Zero or one. A Service observable. See . Zero or one. An EmailData observable. See . Zero or one. A WindowsRegistryKeysModified observable. See . Zero or one. A FileData observable. See . Zero or one. A CertificateData observable. See . Zero or one. A RegistryHandle observable. See . Zero or one. A RecordData observable. See . Zero or one. An EventData observable. See . Zero or one. An Incident observable. See . Zero or one. An Expectation observable. See . Zero or one. A Reference observable. See . Zero or one. An Assessment observable. See . Zero or one. A DetectionPattern observable. See . Zero or one. A HistoryItem observable. See . Zero or one. A bulk list of observables. See . Zero or more. EXTENSION. Mechanism by which to extend the data model. The Observable class MUST have exactly one of the possible child classes. The attributes of the Observable class are: Optional. ENUM. See . Optional. STRING. A means by which to extend the restriction attribute. See .

The BulkObservable class allows the enumeration of a single type of observable without requiring each one to be encoded individually in multiple instances of the same class. The type attribute describes the type of observable listed in the child BulkObservableList class. The BulkObservableFormat class optionally provides additional metadata.

--{0..1}--[ BulkObservableFormat ] | STRING ext-type |<>----------[ BulkObservableList ] | |<>--{0..*}--[ AdditionalData ] +---------------------------+ ]]> The aggregate classes of the BulkObservable class are: Zero or one. Provides additional metadata about the observables enumerated in the BulkObservableList class. See . One. STRING. A list of observables, one per line. Each line is separated with either a LF character or CR and LF characters. The type attribute specifies which observables will be listed. Zero or more. EXTENSION. Mechanism by which to extend the data model. The attributes of the BulkObservable class are: Optional. ENUM. The type of the observable listed in the child ObservableList class. These values are maintained in the "BulkObservable-type" IANA registry per . asn. Autonomous System Number (per the Address@category attribute). atm. Asynchronous Transfer Mode (ATM) address (per the Address@category attribute). e-mail. Email address (per the Address@category attribute). ipv4-addr. IPv4 host address in dotted-decimal notation, e.g., 192.0.2.1 (per the Address@category attribute). ipv4-net. IPv4 network address in dotted-decimal notation, slash, significant bits, e.g., 192.0.2.0/24 (per the Address@category attribute). ipv4-net-mask. IPv4 network address in dotted-decimal notation, slash, network mask in dotted-decimal notation, i.e., 192.0.2.0/255.255.255.0 (per the Address@category attribute). ipv6-addr. IPv6 host address, e.g., 2001:DB8::3 (per the Address@category attribute). ipv6-net. IPv6 network address, slash, significant bits, e.g., 2001:DB8::/32 (per the Address@category attribute). ipv6-net-mask. IPv6 network address, slash, network mask (per the Address@category attribute). mac. Media Access Control (MAC) address, i.e., a:b:c:d:e:f (per the Address@category attribute). site-uri. A URL or URI for a resource (per the Address@category attribute). domain-name. A fully qualified domain name or part of a name (e.g., fqdn.example.com, example.com). domain-to-ipv4. A mapping of FQDN to IPv4 address specified as a comma-separated list (e.g., "fqdn.example.com, 192.0.2.1"). domain-to-ipv6. A mapping of FQDN to IPv6 address specified as a comma-separated list (e.g., "fqdn.example.com, 2001:DB8::3"). domain-to-ipv4-timestamp. Same as domain-to-ipv4 but with a timestamp (in the DATETIME format) of the resolution (e.g., "fqdn.example.com, 192.0.2.1, 2015-06-11T00:38:31-06:00"). domain-to-ipv6-timestamp. Same as domain-to-ipv6 but with a timestamp (in the DATETIME format) of the resolution (e.g., "fqdn.example.com, 2001:DB8::3, 2015-06-11T00:38:31-06:00"). ipv4-port. An IPv4 address, port, and protocol tuple (e.g., 192.0.2.1, 80, TCP). The protocol name corresponds to the "Keyword" column in the "Assigned Internet Protocol Numbers" registry . ipv6-port. An IPv6 address, port, and protocol tuple (e.g., 2001:DB8::3, 80, TCP). The protocol name corresponds to the "Keyword" column in the "Assigned Internet Protocol Numbers" registry . windows-reg-key. A Microsoft Windows registry key. file-hash. A file hash. The format of this hash is described in the Hash class that MUST be present in a sibling BulkObservableFormat class. email-x-mailer. An X-Mailer field from an email. email-subject. An email subject line. http-user-agent. A User Agent field from an HTTP request header (e.g., "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0"). http-request-uri. The Request URI from an HTTP request header. mutex. The name of a system mutex (mutual exclusion lock). file-path. A file path (e.g., "/tmp/local/file", "c:\windows\system32\file.sys"). user-name. A username. ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See . Optional. STRING. A means by which to extend the type attribute. See .

The ObservableFormat class specifies metadata about the format of an observable enumerated in a sibling BulkObservableList class.

--{0..1}--[ Hash ] | |<>--{0..*}--[ AdditionalData ] +---------------------------+ ]]> The aggregate classes of the BulkObservableFormat class are: Zero or one. Describes the format of a hash. See . Zero or more. EXTENSION. Mechanism by which to extend the data model. The BulkObservableFormat class has no attributes. Either Hash or AdditionalData MUST be present.

The IndicatorExpression describes an expression composed of observed phenomenon, features, or indicators. Elements of the expression can be described directly, reference relevant data from other parts of a given IODEF document, or reference previously defined indicators. All child classes of a given instance of IndicatorExpression form a boolean algebraic expression where the operator between them is determined by the operator attribute.

--{0..*}--[ IndicatorExpression ] | STRING ext-operator |<>--{0..*}--[ Observable ] | |<>--{0..*}--[ ObservableReference ] | |<>--{0..*}--[ IndicatorReference ] | |<>--{0..1}--[ Confidence ] | |<>--{0..*}--[ AdditionalData ] +--------------------------+ ]]> The aggregate classes of the IndicatorExpression class are: Zero or more. An expression composed of other observables or indicators. See . Zero or more. A description of an observable. See . Zero or more. A reference to an observable. See . Zero or more. A reference to an indicator. See . Zero or one. An estimate of the confidence in the quality of the terms expressed in the expression. See . Zero or more. EXTENSION. Mechanism by which to extend the data model. The attributes of the IndicatorExpression class are: Optional. ENUM. The operator to be applied between the child elements. See for parsing guidance. The default value is "and". These values are maintained in the "IndicatorExpression-operator" IANA registry per . not. negation operator. and. conjunction operator. or. disjunction operator. xor. exclusive disjunction operator. Optional. STRING. A means by which to extend the operator attribute. See .

Boolean algebraic expressions can be used to specify relationships between observables and indicators. These expressions are constructed through the use of the operator attribute and parent-child relationships in IndicatorExpressions. These expressions should be parsed as follows: The operator specified by the operator attribute is applied between each of the child elements of the immediate parent IndicatorExpression element. If no operator attribute is specified, it should be assumed to be the conjunction operator (i.e., operator="and"). A nested IndicatorExpression element with a parent IndicatorExpression is the equivalent of a parentheses in the expression. The following examples in Figures through illustrate these parsing rules:

2 [O1]: .. 3 [O2]: .. 4 : Equivalent expression: (O1 AND O2) ]]>

2 [O1]: .. 3 [O2]: .. 4 : Equivalent expression: (O1 OR O2) ]]>

2 : 3 [O1]: .. 4 [O2]: .. 5 : 6 [O3]: .. 7 : Equivalent expression: ((O1 OR O2) OR O3) ]]>

2 : 3 [O1]: .. 4 [O2]: .. 5 : 6 : Equivalent expression: (NOT (O1 AND O2)) ]]>

2 : 3 [O1 with low confidence] : .. 4 : 5 : 6 : 7 [O2 with high confidence]: .. 8 : 9 : 10 : Equivalent expression: ((O1) OR (O2)) ]]> Invalid algebraic expressions while valid XML MUST NOT be specified.

The ObservableReference describes a reference to an observable feature or phenomenon described elsewhere in the document. The ObservableReference class has no content.

The ObservableReference class has no content. The attribute of the ObservableReference class is: Required. IDREF. An identifier that serves as a reference to a class in the IODEF document. The referenced class will have this identifier set in its observable-id attribute.

The IndicatorReference describes a reference to an indicator. This reference may be to an indicator described in this IODEF document or in a previously exchanged IODEF document. The IndicatorReference class has no content.

The attributes of the IndicatorReference class are: Optional. IDREF. An identifier that references an Indicator class in the IODEF document. The referenced Indicator class will have this identifier set in its IndicatorID class. Optional. STRING. An identifier that references an IndicatorID not in this IODEF document. Optional. STRING. A version number of an indicator. Either the uid-ref or the euid-ref attribute MUST be set.

The AttackPhase class describes a particular phase of an attack life cycle.

--{0..*}--[ AttackPhaseID ] | |<>--{0..*}--[ URL ] | |<>--{0..*}--[ Description ] | |<>--{0..*}--[ AdditionalData ] +------------------------+ ]]> The aggregate classes of the AttackPhase class are: Zero or more. STRING. An identifier for the phase of the attack. Zero or more. URL. A URL to a resource describing this phase of the attack. Zero or more. ML_STRING. A free-form text description of this phase of the attack. Zero or more. EXTENSION. A mechanism by which to extend the data model. AttackPhase MUST have at least one instance of a child class. The AttackPhase class has no attributes.